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Abstract: Tomography of the two qubit density matrix 
shared by Alice and Bob is an essential ingredient for 
guaranteeing an acceptable margin of confidentiality dur- 
ing the establishment of a secure fresh key through the 
Quantum Key Distribution (QKD) scheme. We show 
how the Singapore protocol for key distribution is optimal 
from this point of view, due to the fact that it is based on 
so called SIC POVM qubit tomography which allows the 
most accurate full tomographic reconstruction of an un- 
known density matrix on the basis of a restricted set of 
experimental data. We illustrate with the help of experi- 
mental data the deep connections that exist between SIC 
POVM tomography and discrete Wigner representations. 
We also emphasise the special role played by Bell states 
in this approach and propose a new protocol for Quan- 
tum Key Distribution during which a third party is able 
to concede or to deny A POSTERIORI to the authorized 
users the ability to build a fresh cryptographic key. 



I. INTRODUCTION 

The goal of quantum cryptographic protocols is to dis- 
till a fresh cryptographic key from data encoded in non- 
commuting bases. In order to guarantee the confiden- 
tiality of the key, it is essential that Alice and Bob, the 
authorized users of the channel, check the correlations 
between their respective signals in order to estimate the 
noise present along the transmission line. This procedure 
imposes severe constraints to an hypothetical eavesdrop- 
per (Eve) who cannot manipulate the signal at will and 
sees her freedom of action seriously limited by the control 
performed by Alice and Bob. This control procedure is 
optimal when the correlations tested by Alice and Bob 
are such that they allow them to carry out a full to- 
mography of the signal [1 . This the case for instance 
with the so called 6 states protocol [2] during which Alice 
and Bob analyze their qubits in three mutually unbiased 
bases, which allows them to reconstruct the full density 
matrix of the signal. Due to the fact that in realistic 
situations the length of the key is always finite and that 
it is preferable that Alice and Bob do not sacrifice too 



many data during their check of the correlations, the op- 
timal tomographic procedure is the one for which Alice 
and Bob are able to maximize the accuracy of their esti- 
mation of the signal, keeping fixed the quantity of data 
that they sacrifice in order to estimate the correlations. 
This problem has been studied in the past and it appears 
that the optimal procedure for performing full tomogra- 
phy (according to this figure of merit) is to measure a 
Symmetric Informationally Complete Positive Operator 
Valued Measure (SIC POVM) [3 HE]. This approach 
is at the core of the so called Singapore protocol [6] for 
Quantum Key Distribution where the signal is encrypted 
in such a way that Alice and Bob directly measure the 
SIC POVM distribution of their respective bits, and are 
consequently able to reconstitute the two qubit density 
matrix of the full signal. 

In the present paper we shall discuss certain advan- 
tages of the double qubit SIC POVM scheme from the 
point of view of tomography (section [nj. We shall then 
establish a relation between SIC POVM tomography and 
the discrete Wigner representation (section |III| and ap- 
pendix) . We shall also show (section |IV[ ) that the Bell 
states constitute the optimal signal for the establishment 
of a cryptographic key. In the same section, we shall 
show how it is possible thanks to slight modifications of 
the Singapore protocol [B] to provide to a third party who 
controls the source (Charles) the ability to deny to Al- 
ice and Bob the possibility to build a fresh key although 
they already recorded all the results of their measure- 
ments. Charles has nevertheless the possibility to choose 
a posteriori to provide them the possibility to do so, by 
communicating to them the relevant information on a 
classical communication line. Besides, even in the case 
that he allows them to establish a fresh key, Charles re- 
mains ignorant of the content of this key. 

It is worth noting that, due to the fact that it is impos- 
sible to amplify a quantum cryptographic key by classical 
amplifiers, which prohibits the use of standard communi- 
cation channels, the installation of a communication line 
for QKD will remain an expensive investment. It is thus 
probable that in the case that quantum cryptography 
gets succesfully commercialised, Alice and Bob, the au- 
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thorized users of a quantum cryptographic channel, will 
not own it personnally but they will rather rent it to its 
owner (Charles). In the case that Alice and Bob rent the 
line to Charles in order to exchange a key, the protocol 
described in this paper presents obvious advantages re- 
garding the possible commercialisation of Quantum Key 
Distribution. 

Finally, we shall present in the section |V| experimental 
results that show that within an error of a few percent, 
all the theoretical concepts developed in this paper are 
concretely realisable. 

II. ABOUT TWO QUBIT TOMOGRAPHY. 
A. Optimal PVM tomography. 

The estimation of an unknown state is one of the im- 
portant problems in quantum information and quantum 
computation 18] . Traditionnally, the estimation of the 
d 2 — 1 parameters that characterize the density matrix of 
a single quciit consists of realising d + 1 independent von 
Neumann measurements (also called Projection- Valued- 
Measure measurements or PVM measurements in the lit- 
terature) on the system. 

As it was shown in [TU] , the PVM approach to to- 
mography can be optimised regarding redundancy dur- 
ing the acquisition of the data. Optimality according to 
this particular figure of merit is achieved when the d + 1 
bases in which the PVM measurements are performed are 
"maximally independent" or "minimally overlapping" so 
to say when they are mutually unbiased (two orthonor- 
mal bases of a d dimensional Hilbert space are said to be 
mutually unbiased bases (MUB's) if whenever we choose 
one state in the first basis, and a second state in the 
second basis, the modulus squared of their in-product is 
equal to 1/d) [SJ[TDJ[TT]. It is well-known that, when the 
dimension of the Hilbert space is a prime power, there ex- 
ists a set of d+1 mutually unbiased bases [9 , 10, 12J. This 
is the case for instance with the bases that diagonalize the 
generalised Pauli operators |T21 [T3] ■ Those unitary oper- 
ators form a group which is a discrete counterpart of the 
Heisenberg-Weyl group, the group of displacement opera- 
tors |14j , that present numerous applications in quantum 
optics and in signal theory [T5] . 

For instance, when the system is a spin 1/2 particle, 
three successive Stern-Gerlach measurements performed 
along orthogonal directions make it possible to infer the 
values of the 3 Bloch parameters p x ,P y , and p z defined by 

!(a x ) = p x = 7 sin 9 cos tp 
{(jy) = p y — 7 sin 9 sin p (1) 
(cr 2 > =p z = 7COS0 

Once we know the value of these parameters, we are able 
to determine unambiguously the value of the density ma- 
trix, making use of the identity 

P{l,8,V>) = ^(I+PxCTx+Py<?y+Pz<?z) = .~a) (2) 



When the qubit system is not a spin 1/2 particle but 
consists of the polarisation of a photon, a similar result 
can be achieved by measuring its degree of polarisation 
in three independent polarisation bases, for instance with 
polarising beamsplitters, which leads to the Stokes rep- 
resentation of the state of polarisation of the (equally 
prepared) photons. 

Tomography through von Neumann measurements 
presents an inherent drawback: in order to estimate the 
d 2 — l independent parameters of the density matrix, d+ 1 
measurements must be realised which means that d 2 + d 
histograms of the counting rate are established, one of 
them being sacrificed after each of the d+1 measure- 
ments in order to normalize the corresponding probabil- 
ity distribution. From this point of view, the number 
of counting rates is higher than the number of parame- 
ters that characterize the density matrix, which is a form 
of redundancy, inherent to the tomography through von 
Neumann measurements. 

In the case of tomographic protocols for QKD, Alice 
and Bob necessarily perform locally and independently a 
tomographic process on their respective qubits because 
they are separated in space and are not able in principle 
to carry out non-local measurements [T3J [TB] . Of course 
by comparing the data gathered during local measure- 
ments they can reconstruct the full density matrix but 
this procedure is highly data consuming in the case of 
von Neumann (PVM) tomography. For instance, in the 
case that the carrier of the key is a qubit it requires them 
to estimate 36 joint probabilities. In the framework of 
Quantum Key distribution where the number of available 
data is per se limited and where the protocols of recon- 
ciliation and privacy amplification are per se highly data 
consuming it is better to find a tomographic procedure 
that minimizes the redundancies in the data acquisition. 
We shall discuss this procedure in the next section. 



B. Optimal qubit POVM's for tomography. 

It is known that a more general class of measurements 
exists that generalises the von Neumann (PVM) mea- 
surements. This class is represented by the Positive- 
Operator- Valued Measure (POVM) measurements [17], 
of which only a reduced subset, the Projection- Valued- 
Measure (PVM) measurements correspond to the von 
Neumann measurements. The most general POVM can 
be achieved by coupling the system A to an ancilla or as- 
sistant B and performing a von Neumann measurement 
on the full system. When both the system and its as- 
sistant are quefit systems, the full system belongs to a 
d 2 dimensional Hilbert space which makes it possible to 
measure d 2 probabilities during a von Neumann measure- 
ment performed on the full system. As always, one of the 
counting rates must be sacrificed in order to normalise 
the probability distribution so that we are left with d 2 -l 
parameters. When the coupling to the assistant and the 
von Neumann measurement are well-chosen, we are able 
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in principle to infer the value of the density matrix of the 
initial qucfit system from the knowledge of those d 2 — 1 
parameters, in which case the POVM is said to be In- 
formationally Complete (IC). Obviously, this approach 
is optimal in the sense that it minimizes the number of 
counting rates (thus of independent detection processes) 
that must be realised during the tomographic process. 
In practice, the implementation of this class of optimal 
POVMs is simple and has advantages of its own com- 
pared to the usual polarization measurements based on 
von Neumann projections |18j . 

IC POVM's can also be further optimised regarding 
the independence of the data collected in different detec- 
tors. The so-called covariant Symmetric-Informationally- 
Complcte (SIC) POVM's [5] provide an elegant solution 
to this optimisation constraint. A discrete version of the 
Heisenberg-Weyl group [19] also plays an essential role 
in the derivation of such POVM's which are intimately 
associated to a set of d 2 minimally overlapping projec- 
tors onto pure qudit states (the modulus squared of their 
in-product is now equal to 1). 

In the rest of this paper we shall remain exclusively 
concerned with qubit SIC POVM's. It has been shown 
in the past, on the basis of different theoretical argu- 
ments [21 H |S], that the optimal qubit SIC POVM is 
in one-to-one correspondence with a tetrahedron on the 
Bloch sphere. Intuitively, such tetrahedrons homogenize 
and minimize the informational overlap or redundancy 
between the four histograms collected during the POVM 
measurement. Some of such tetrahedrons can be shown 
to be invariant under the action of the Heisenberg-Weyl 
group which corresponds to so-called Covariant Symmet- 
ric Informationnally Complete (SIC) POVM's [3]. Con- 
cretely, during the measurement of such a SIC POVM, 
four probabilities of firing P 0j Pn, -Po, Pn are measured 
which are in one-to-one correspondence with the Bloch 
parameters p x ,p y , and p z as shows the identity 

f r 

^00 = \ 1 + (Px + Py + Pz) 

( Pt>x = k'l + ^(-p*-Pv+P,j\ (3) 

■PlO = i 1 + 7j(Px - Py - Pz) 
P 11 = I 1 + ~^(-Px +Py -Pz) 

2 ■ Poo is the average value of the operator 
(|)(<ro,o + (^|)(o-i,o + oui + 0-1,1)) (where a id = 

V / H I7 ELo(-)^> + imod.2)(k|; actually, CTo ,o = 
Id., cr ,i = er z , cti j0 = <J x ,&i,i = a y ). One can 
check that this operator is the projector |</>)(</>| onto 

the pure state \<j>) = a|0) + with a = Jl + 

j3* = eT ^/l — Under the action of the Pauli 

group it transforms into a projector onto one of the 
four pure states Ui j\4>); i,j : 0,1: Oi j\ 4>){4> \&i j — 
(!)((! - ^Ko + (^HEl^oH^- V/)) The signs 
(-) 1 ' i_3 ' t; reflect the (anti)commutation properties of the 



Pauli group. So, the four parameters Pij are the aver- 
age values of projectors onto four pure states that are 
"Pauli displaced" of each other. The in-product between 
them is equal, in modulus, to l/\/3 = l/y/d + 1, with 
d = 2 which is the signature of a Symmetric Information- 
nally Complete (SIC) POVM [3]. One can show [3j|Il|5] 
that such tetrahedrons minimize the informational re- 
dundancy between the four collected histograms due to 
the fact that their angular opening is maximal. The num- 
ber of counting rates necessary in order to realize a to- 
mographic process by a factorisable POVM measurement 
is optimal and equal to 16 in the two qubit case. More- 
over, the double qubit SIC POVM tomographic scheme 
is optimal among the factorisable two qubit schemes if we 
consider as a figure of merit* [35] the determinant D of 
the matrix that maps the joint probabilities of firing that 
are collected during the experiment onto the coefficients 
of the density matrix [4]. This determinant is optimal 
(minimal) for the SIC POVM (tetrahedron process) in 
the single qubit case and factorizes when the tomographic 
process does, so that the determinant of the double tetra- 
hedron process is extremal among the determinants of all 
factorisable tomographic processes. 

For all these reasons, the SIC POVM approach is at the 
core of the so called Singapore protocol |6J for Quantum 
Key Distribution where the signal is encrypted in such a 
way that Alice and Bob directly measure the SIC POVM 
distribution of their respective bits. 

III. QUBIT SIC POVM'S AND DISCRETE 
WIGNER DISTRIBUTION. 

A. The single Qubit case. 

The qubit covariant SIC POVM possesses another very 
appealing property |20j which is also true in the qutrit 
case but not in dimensions strictly higher than 3 [21]: 
the qubit Covariant SIC POVM is a direct realisation 
(up to an additive and a global normalisation constants) 
of the qubit Wigner distribution of the unknown qubit 
a. Indeed, this distribution W is the symplectic Fourier 
transform of the Weyl distribution w [551 H3] (defined 
by the relation Wij = (l/2)Tr.(p.aij)) which is, in the 
qubit case, equivalent (up to a relabelling of the indices) 
to its double qubit-Hadamard or double qubit-Fourier 
transform: 

1 

W kJ = (1/2) £ {-f l - j - k w i4 

i>J=Q 

1 1 
= ((1/V2) £(-) W )((l/V2) ER-^K,-- (4) 
i=o j=a 

One can check that P ktl = (l/V3)W fc ,; + (1 - 1/a/3)/4. 
The discrete qubit Wigner distribution directly gener- 
alises its continuous counterpart [24j in the sense that it 
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provides information about the localisation of the qubit 
system in a discrete 2 times 2 phase space [33 |2"5] . 
For instance the Wigner distribution of the first state 
of the computational basis (spin up along Z) is equal 
to Wk,i(\0}) = (l/2)Sk : o, which corresponds to a state 
located in the "position" spin up (along Z), and homo- 
geneously spread in "impulsion" (in spin along X), in 
accordance with uncertainty relations 26J . Similarly, the 
Wigner distribution of the first state of the complemen- 
tary basis (spin up along X) is equal to Wk,i((l/V2)(\0) + 
|1))) = (l/2)<5; o- For information, the fidelities that were 
achieved in recent experimental realisations of one qubit 
SIC POVM tomography were shown to be of the order of 
92 % in a NMR realisation [27] and 99 % in a quantum 
optical realisation [15] . 



B. The double Qubit case. 

Certain Wigner distributions factorise in the sense that 
in the two qubit case it is possible to measure a two-qubit 
or quartit Wigner distributions [28, 29 by measuring si- 
multaneously local qubit SIC POVMs. For instance a fac- 
torisable Wigner distribution derived in Refs.|28[ 129] in 
the case d = 4 is obtained by performing the tetrahedron 
measurement on the first qubit and the anti-tetrahedron 
measurement on the second qubit. The tops of the anti- 
tetrahedron are obtained from the tops of the tetrahe- 
dron by performing on the Bloch sphere a central sym- 
metry around the origin. This transformation is not uni- 
tary, but we shall now show that the anti-tetrahedron is 
equivalent to the tetrahedron, up to a well-chosen uni- 
tary transformation, provided we modify the order of its 
branches accordingly. 

The tops of the anti-tetrahedron are obtained from 
the tops of the tetrahedron by performing on the Bloch 
sphere a central symmetry around the origin. This trans- 
formation is not unitary, but we shall now show that the 
anti-tetrahedron is equivalent to the tetrahedron, up to 
a well-chosen unitary transformation, provided we mod- 
ify the order of its branches accordingly. Indeed, as we 
noted before (Eqn.([3])) the probabilities Pij = 0,1) 
of firing of the detectors associated to the tops of the 
tetrahedron are equal, up to a normalisation factor ~ 
to the Born probabilities of transition onto pure states 
that are "Pauli displaced" of each other. For instance 

1 + i (cr x + <j y + a z ) corresponds to Poo an d is the 

projector onto the pure state \<f>) = a|0) + /3*|1) with 

a = J\ + /3* = eT ^/l — -^j that is represented on 

the Bloch sphere by the vector 4=(1,1, 1). The three 
other probabilities of firing that are measured during 
the qubit SIC POVM tomographic process are the Born 
probabilities of transition to pure states of which the rep- 
resentation on the Bloch sphere can be obtained by ro- 
tating the representation of \<p) of 180 degrees around the 
axes X, Y and Z. An anti-tetrahedron can be obtained 
from the tetrahedron by complex conjugating the four 



tops of the tetrahedron. In what follows, the a x and a z 
operators are assumed to contain real coefficients, and 
a y to be purely complex. On the Bloch sphere, the four 
tops of the anti-tetrahedron are then easily seen to be 
obtained by performing onto the tops of the tetrahedron 
a central symmetry through the origin. 

The union of the 4 tops of the tetrahedron and of the 
anti-tetrahedron forms a set of 8 tops which spans a per- 
fect cube of which the 3 axes of symmetry coincide with 
the X, Y and Z axes. 

Now, if we rotate the tops of the anti-tetrahedron 
(tetrahedron) according to the orthogonal transforma- 
tion O described by the matrix: 



O 




(5) 



we obtain the original tetrahedron (anti-tetrahedron). 
In the following we shall label the tops of the anti- 
tetrahedrons with the same label as for their image 
through the central symmetry through the origin (so 
that the labels (00), (01), (10) and (11) respectively cor- 
respond to the directions ^=(—1,-1,-1), ^=(1,1,-1), 

1,1) and ^(1, -1,1)). 
Due to the fact that the tetrahedron is an oriented 
object in the 3-dimensional space, the images of the tops 
rotated by O and their images obtained after inversion 
through the origin (So = —Id.) are not necessarily two 
by two equal: 



0.(1,1,1) = (-1,-1,-1) = s„.(i, i,i); 



(6) 



0.(1,-1,-1) = (1,1,-1) = S„.(-l,-l,l); (7) 



0.(-l,l,-l) = (1,-1,1) = 5 .(-l, 1,-1) (8) 



and 



O. 



-1,1) = (-1,1,1) =So.(l, -1,-1). (9) 



Roughly speaking this means that in order to pass from 
the tetrahedron-tetrahedron (T-T) configuration to the 
tetrahedron-anti-tetrahedron (T-A) configuration (a very 
general definition of the precise meaning of what we mean 
by these words is given in the next section, here their ac- 
ceptance ought to be made clear by the context), it is 
sufficient to permute a pair of (well-chosen) indices (here 
(01) and (10)), and to perform a (well-chosen) rotation 
which corresponds at the level of Bob's qubit Hilbert 
space to a (well-chosen) unitary transformation. 

Henceforth we shall most often in the following refer to 
the simultaneous measurement of local SIC POVMs un- 
der the label "double tetrahedron" measurement with- 
out precising whether we group the 16 joint proba- 
bilities assigned to the 8 (4+4) detectors according 
to the Tetrahedron- Tetrahedron (TT) or Tetrahedron- 
Antitetrahedron (TA) configuration. 
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FIG. 1: Relative orientation of the tetrahedron (left) and an- 
titetrahedron (right) POVMs on the Bloch sphere. Trans- 
forming from the tetrahedron POVM to the antitetrahedron 
POVM involves both a rotation and a relabeling of the pos- 
sible outcomes. 



C. Double tetrahedron measurement and 
tomography. 

The relation between the statistics of the double tetra- 
hedron measurement and the double Wigner distribution 
is a straightforward generalisation of the corresponding 
relation in the single qubit case. Let us denote Pkj 
(where k and I run from to 3) the joint probability 
of firing of the fcth (Zth) tetrahedron detector on qubit 
a (tetrahedron detector on qubit&), and let us define P% 

(i?) by Pg = £f =0 P$ (P? = YLoPfi), then the 
double Wigner coefficients Wk,i can be derived from the 
statistics of joint detections via the relation 

Wti = 3-P^ + V3-(l-^)/4.(P, a + ^) + ((l~y3)/4) 2 

( 10 ) 

where the indices k and I run from to 3. 

As the Wigner operators form a basis of the 4 times 
4 linear operators and are orthogonal relatively to the 
Trace-norm, we can reconstruct the full density matrix 
once we know its double Wigner coefficients, and those 
are in one to one correspondence with the joint probabil- 
ities of firing of the detectors associated to branches of 
the local (a and b) tetrahedrons. 

In a next section we shall study the properties of 
Wigner distributions of Bell states and compare theo- 
retical predictions with data obtained from direct exper- 
imental measurement of the correlations. 



IV. OPTIMAL ENTANGLED STATES AND 
CRYPTOGRAPHY. 

A. Optimal entangled states for cryptography. 

We learnt from the entanglement-based protocol pro- 
posed by Artur Ekert [3U] that it can be useful to exploit 



non-local correlations between entangled distant quan- 
tum systems in order to build a fresh cryptographic key. 
At this level we did not mention yet explicitly in which 
bipartite (two qubit) state the signal was prepared. We 
shall now show that when the key is established by the 
double tetrahedron protocol (as in Singapore's protocol 
[6]), the optimal strategy is to prepare the pairs of qubits 
sent to Alice and Bob along Bell states (up to local uni- 
taries) . 

The main argument is a symmetry argument. As we 
mentioned, qubit SIC POVMs are optimal because they 
are symmetric e.g. such POVMs are defined by 4 pure 
states that form an equiangular set (tetrahedron) and are 
treated on the same footing. In order to exploit maxi- 
mally this symmetry it is natural to try to find entangled 
states that exhibit cither symmetric correlations or sym- 
metric anti-correlations between different branches of the 
tetrahedrons in the a and b regions. As the tomographic 
process is full (the Wigner operators form a complete 
orthonormal basis), once we know the correlation, we 
also know the state that produces such correlations. We 
shall show that all states that exhibit symmetric anti- 
correlations are Bell states up to well-chosen local uni- 
taries (rotations), and that no physically realisable state 
exhibits symmetric correlations. 

In the case that we consider situations during which 
the experimental configuration of Alice and Bob's devices 
is fixed there remains a single degree of freedom that 
consists of varying the labels of the 4 detectors at each 
side. 

There are then essentially 4!=24 ways (and not 24 2 
ways due to the isotropy of correlations) to group the 
branches of the tetrahedrons at each side, so that we 
must now investigate the possibility of perfect correla- 
tions (anti-correlations) in each of those cases. The 24 
permutations between the four tops of the tetrahedron 
can be realised either by unitary or by anti-unitary trans- 
formations so that those permutations can be partitioned 
according to their order and their parity (we can define 
the parity of a permutation in function of the determi- 
nant of the 3x3 matrix that represents the action at 
the level of the Bloch sphere of the orthogonal or "anti- 
orthogonal" transformation that realises the correspond- 
ing permutation at the level of the tetrahedron branches: 
even transformations correspond to a value +1 (orthog- 
onal transformations), odd ones to -1 ("anti-orthogonal" 
transformations) ) * [37] . 

The identity is even and of order 1, there are 3 (4-3/2-2) 
even permutations of order 2 with no fixed top and 6 
(4 ■ 3/2) odd permutations of order 2 with two fixed tops, 
8 (4 ■ 2) even permutations of order 3 with one fixed top 
and 6 odd permutations of order 4 with no fixed top. 
These 12 (identity+11) even permutations can be realised 
by unitary transformations: the 3 even permutations of 
order 2 with no fixed top are associated to the Pauli a 
operators (rotations of 180 degrees around X, Y and Z) 
while the 8 even permutations of order 3 with one fixed 
top correspond to rotations of +/-120 degrees around the 
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axis of the fixed top. 

The 12 remaining (odd) permutations can be decom- 
posed into an odd permutation and an even permuta- 
tion that can be realised by one among the 12 afore- 
mentioned unitary transformations [38]. The reasoning 
goes as follows: once we impose symmetric correlations 
(anti-correlations) the Wigner distribution is fully deter- 
mined and so is the density matrix of the corresponding 
state. In principle we ought to construct case by case 24 
candidate-states for the symmetric correlations and 24 
other ones for the symmetric anti-correlations, and check 
whether the candidates that we find so are physical states 
(positive definite hcrmitian operators of trace 1). Due to 
the unitary equivalence between all even configurations 
and all odd ones, it is enough to check 2 candidates in 
the case of perfect correlations and two candidates in the 
case of perfect anti-correlations, what we shall do now. 

Let us firstly consider a TT (even) configuration 
and let us assume the existence of perfect correla- 
tions between equally labelled detectors at Alice and 
Bob's sides so that the joint probabilities obey i\; = 
{X/A)8k,i; k, I : 0,1,2,3. The expression (10) considerably 



simplifies in case of symmetric correlations, when all de- 
tectors fire with equal probability one fourth at each side. 
Then we have 



^ = 3-^- (1/8). 



(11) 



Making use of this relation we get that Wk.i = 
(-1/8) + (3/4)5^; k,l : 0,1,2,3. Making use of the iden- 
tity p = EL,fc 6 ,; £ ,,/ i) =o(l/ 4 ) w/ fea,iaW / fe !) ,i 6 whcrc thc local 
(qubit) Wigner operators were defined in Eqn.( [4]), we 
find by a straightforward computation that 

p=(l/4)iId. ab + 3(a x a b x + a Y * b Y + a z a b z )) = \00)(00\ + 
|11)<11| - (1/2)|01)(01| - (1/2)|10)(10| + (3/2)|01)(10| + 
(3/2) 1 10) (01 1 . Such an operator possesses a negative 
eigenvalue so that it cannot be realised physically. 

If now we impose perfect (and isotropically dis- 
tributed) anti-correlations then the joint probabilities 
must obey P M = (1/12) - (1/12)4,;; k,l:0, 1,2, 3. 

By a similar treatment, we find that 



W k> i = (1/8) - (l/4)6 ktl \k, I : 0, 1, 2,3 (12) 



and 

p=(l/A)(Id. ab - a\a\ 



- a Y a b Y - a z u\)= |*")(*-| 
b - |0) a |l) b ), which is nothing 



where |*-) = ^(|1>« 
else than the projector onto the singlet state. In the pre- 
vious treatment we assumed that a TT configuration had 
been chosen. If instead we impose perfect correlations 
(anti-correlations) in a TA configuration, that we choose 
at this level to be such that we can replace Wk b ,i b by a 
similar operator but with opposite signs in front of the 
operators a x , <j v and cr 2 (this is a configuration where in- 
stead of orienting their tetrahedrons parallely, Alice and 
Bob choose an experimental set-up in which they orient 



them anti-parallely* [39 . Imposing now perfect correla- 
tions (anti-correlations) between equally labelled detec- 
tors in this configuration we find by a direct computation 
that 

p=(l/4)(Id. ab - 3(a x a b x + a Y a Y + o a z o b z )) in the first 
case and 

p=(l/A){Id. ab + o a x a\ + a Y a h Y + er£er|) in the second 
case. 

Such operators are easily shown to admit nega- 
tive eigenvalues so that no physically acceptable state 
would allow us to obtain symmetric correlations or anti- 
correlations in this particular configuration. Actually 
this is not so astonishing for what concerns symmet- 
ric anti-correlations because the partial transposition of 
a singlet state provides a non-physical state as is well- 
known |31j . 

As a consequence of the fact that the 12 TT (even) con- 
figurations as well as the 12 TA (odd) ones are unitarily 
equivalent, we have established the following properties: 

A. "In each of the 12 TT configurations there exists ex- 
actly one state that exhibits symmetric or isotropic anti- 
correlations, and this state is equivalent to the singlet 
state up to a well-defined local unitary transformation. " 

B. "In each of the 12 TA (odd) configurations, it is 
impossible to find a state that exhibits perfect anti- 
correlations between Alice and Bob 's detectors. " 

C. "In each of the 12 TA (odd) and 12 TT (even) con- 
figurations, it is impossible to find a state that exhibits 
perfect correlations between Alice and Bob 's detectors. " 



B. Optimal entangled states and generalised 
cryptographic protocol. 

It is worth noting that when we locally rotate the sin- 
glet state around the axis of one of the tops of the tetra- 
hedron, or around its major axes (X, Y and Z), we still 
obtain a state that is equivalent, up to a local unitary 
transformation, to a singlet state and is thus maximally 
entangled. 

In particular, when we locally rotate the singlet state 
around the one of the major axes (X, Y and Z) of the 
tetrahedron, we still obtain a Bell state. Those transfor- 
mations can be shown to form a group, the Pauli group 
or discrete displacement (Heisenberg-Weyl) group* [30]. 

As the four Bell states can be obtained from the sin- 
glet state by letting act locally one of the Pauli displace- 
ment (a) operators onto the singlet state and that these 
operators map the tetrahedron onto itself, the four Bell 
states exhibit symmetric and perfect anti-correlations at 
the level of Alice and Bob's detectors. 

Besides, one can easily check that different Bell states 
anti-correlate one detector at Alice's side with different 
detectors at Bob's side and vice versa. This is the main 
feature that we shall exploit in what follows: when Alice 
and Bob ignore which Bell state they share, they also 
ignore which of their detectors are anti-correlated and 
are unable to establish a key. 
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Let us now assume that a third party (Charles) con- 
trols the source, say a singlet state source (actually a 
source of an arbitrary Bell state would be equally con- 
venient) and has the possibility to rotate at will Bob's 
qubit of 180 degrees around one of the three main axes 
of Bob's tetrahedron (or to do nothing). If Charles de- 
cides to carry out one of those four rotations (Pauli dis- 
placements) at random with equal probability (25 per- 
cent) without communicating his choices to Alice and 
Bob, their signal will obviously be totally uncorrected. 
If now Charles decides afterwards to inform them about 
his respective choices they will be able to reconstruct a 
confidential key (according to the Singapore protocol [B] 
for instance). Due to the symmetry of the correlations 
exhibited by the Bell states, Charles will remain totally 
ignorant of the data measured by Alice and Bob, which 
guarantees the confidentiality of their key. 

We sec thus that Charles possesses the capacity to deny 
at will to Alice and Bob the authorization to establish 
a fresh key, even after they measured all the necessary 
data. This possibility could lead to interesting appli- 
cations in realistic quantum cryptographic schemes, for 
instance in the case that Alice and Bob would rent the 
cryptographic quantum transmission line to Charles, its 
legitimate owner, who would be supposed to be able to 
control the source and to produce at will one among the 
4 Bell states. 

In the next section, we represent experimental confir- 
mations of our theoretical predictions concerning anti- 
correlations exhibited by Bell states. 



V. EXPERIMENTAL TOMOGRAPHY OF 
BELL STATES. 

The afore mentioned Singapore protocol for QKD, in 
which Alice and Bob share a single state and establish 
a secret key on the basis of the anti-correlations exhib- 
ited by this singlet state when they both realize an op- 
timal SIC POVM onto their respective qubit has been 
implemented experimentally (see fig. [2]). Among others 
this implementation requires a simple polarimetric set- 
up in order to realize the qubit covariant SIC POVM. 
This setup was shown in the past to perform tomographic 
reconstruction of any arbitrary qubit state with high fi- 
delity (differing from unity by less than 1 percent) [T5] . 

We used a pair of such set-ups in order to implement a 
double tetrahedron measurement on arbitrary Bell states. 
To prepare the Bell states, we used a Spontaneous Para- 
metric Down Conversion (SPDC) source of entangled 
photon pairs [35]. The pairs of photons are identified 
by coincidence timing and the probabilities derived from 
the raw count rates via normalization to the total number 
of coincidences (fig(3| . 

We firstly prepared the singlet Bell state |>I'~) = 
^(|l) a |0) b - |0) a |l) b ), that we measured in the TT con- 
figuration and also in the TA configuration. 

In a second time, we prepared the Bell state |<i> + ) = 



PPBS QP XI2 PBS 



QP 
PBS 



D1 



' D2 



D3 



1 D4 



FIG. 2: Experimental implementation of a single tetrahedron 
measurement. The incoming photon is incident upon a par- 
tially polarizing beam splitter (PPBS) and each of the output 
arms is modified by the combination of a quartz plate (QP) to 
modify the phase between H and V polarizarions, and either 
a quarter wave plate (A/4) or a half wave plate (A/2) to ro- 
tate into the right measurement basis. The final projection is 
performed by polarizing beam splitters (PBS). The individual 
photons are detected by Si avalanche photo diodes. Chang- 
ing from a tetrahedron to an anti-tetrahedron measurement 
involves only a change in orientation of the waveplates and a 
relabelling of the detector outputs. 



individual 
detection 
probabilities 



joint 

detection 
probabilities 



photon a 



Po 



photon b 



coincidence 
unit 



n ab 

Poo 



FIG. 3: Tetrahedron based measurements. Each member of a 
photon pair is sent to a measurement device implementing ei- 
ther the tetrahedron (T) or anti-tetrahedron (A) POVM (see 
also Fig. |2j. Coincidence timings between a pair of tetrahe- 
dron measurements are translated into probabilities by nor- 
malizing each joint detection between a particular detector 
pair to the total number of joint detections. 



^(|0) a |0) b + |l) a |l) b ) that we measured in the TT con- 
figuration. 

In each case we measured the correlation matrices that 
represent the relative frequency of coincidental signals 
between the detectors of Alice and Bob. 

On the basis of those matrices we obtain making use 
of the relation ( 10 1 their respective Wigner distributions. 



The ideal, theoretical counterpart of t he Wigner ma- 
trice W TT ( i Sf~) is expressed by Eqn.(12l: 
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FIG. 4: Experimental (left) versus theoretical (right, FIG. 5: Experimental (left) versus theoretical (right, 



Eqn.(18l) histograms of the Wigner distribution of the sin- 
glet state in the TT configuration. 



Eqn.(18l) histograms of the Wigner distribution of the state 
$ + in the TT configuration. 



W 11 ^') = (1/8) 




(13) 



The counterpart of Wj^ D ) can be shown to be 



equal to: 



<lon = a/4) 



Similarly, one gets that 



/ 1 
10 
10 

Vo o o i 



(14) 




FIG. 6: Experimental (left) versus theoretical (right, 



Eqn.(17l) histograms of the Wigner distribution of the sin- 
glet state in the TA configuration. 



W TT (<f> + ) = (1/8) 




(15) 



We controlled that, up to experimental discrepancies and 
ad hoc reorderings of the coefficients, the experimental 
Wigner distributions corresponded to their theoretical 
counterpart. Those results are plotted in figures [4][5] and 
1 

We could estimate by a straightforward computation 
the fidelity of the experimental tomographic procedure, 
making use of the orthonormalisation of the Wigner op- 
erators regarding the trace norm. The fidelity is equal 
to four times the sum of the products of the experimen- 
tally obtained Wigner coefficients with their theoretical 
counterparts. We obtain so fidelities equal to 0.960 and 
0.956 for the singlet state in the TT and TA con- 

figurations, and a bit less for the <I> + state. The fidelities 
are less high than for the single qubit tomographic pro- 
cess [TB] , which is not astonishing because in the present 
case, additive experimental errors are likely to occur at 
the level of the source of entangled states, and also at 
both sides during the local one qubit SIC POVM pro- 
cesses. Moreover supplementary errors could also be due 



to a misalignment between the local tetrahedrons and to 
finite-size statistical effects (the sample sizes were of the 
order of 4 • 10 4 ). 

In appendix, the question of the factorisability of two 
qubit Wigner distributions [23 , 29] is discussed in details 
in relation with the two possible choices of configurations 
(TT and TA). 



VI. CONCLUSION. 

Protocols for quantum key distribution that allow Al- 
ice and Bob to perform full tomography of the signal 
are optimal for what concerns security against eavesdrop- 
ping. Due to the fact that in such protocols the amount of 
data is per se limited, full tomographic protocols based 
on SIC POVM tomography are also optimal for what 
concerns the authentification protocol. We showed that 
the natural entangled states that respect the symmetry 
of SIC POVMs are the Bell states (up to local unitaries) . 
We also showed how their properties make it possible to 
conceive a protocol during which a third party (Charles) 
controls the source and is free to concede the authoriza- 
tion to Alice and Bob to establish a key AFTER they 
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measured all the physical data necessary therefore. This 
possibility opens the way to interesting applications in 
the case of realistic commercial developments of quan- 
tum cryptography; for instance it opens the possibility 
of delayed on-line payment by the users who rent the 
cryptographic line. 

It is worth mentioning before we end this conclusion 
that, after all, as was drawn to our attention by a referee, 
the performances of POVM-based protocols in compari- 
son to those based on PVM's must be relativised. This 
is due to several reasons. 

Firstly, an apparent advantage of the POVM scheme 
is that it is not necessary to change constantly and ran- 
domly the measurement basis so that we avoid the losses 
due to basis-reconciliation (sifting) but one should note 
that the effective gain in bit transfer rate is negligible in 
comparison to say the BB84 protocol because the POVM- 
based protocol requires a post-treatment of the correlated 
data [B] that is equally data consuming. 

Secondly one could imagine that even in the (Ekert ver- 
sion of the) BB84 protocol the owner of the line Charles 
controls the source and encodes the signal at random in 
the Bell states 'J - and 4> + . In such a case Alice and 
Bob's signal is an incoherent sum with equal weights of 
perfectly correlated and anti-correlated signals (in the X 
and Z bases). Such a signal is totally useless for estab- 
lishing a key before Charles accepts to reveal to Alice and 



Bob what were his prepared states. The feasibility of a 
modified BB84 protocol based on entangled photons has 
been proven experimentally [33 . 

In principle, the number of copies needed for state esti- 
mation can be made arbitrarily smaller than the number 
of copies needed for the key and it is only when consid- 
ering finite number effects in a practical implementation 
that it is advantageous to use a POVM measurement in- 
stead of a conventional, PVM, one. 

Finally it should be noted in order not to finish our pa- 
per with a sweet and sour note that, beside advantages re- 
garding tomography, POVM emasurements also present 
effective advantages regarding calibration and stability 
and remain a promising candidate for quantum key dis- 
tribution. 
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Let us consider as an illustrating example that conven- 
tional, PVM, qubit tomography is realized in 3 nearly 
linearly dependent bases, very close to each other. This 
is obviously a bad tomographic process regarding the re- 
dundancy of the collected data. In such a situation, cer- 
tain coefficients of the density matrix must be estimated 
on the basis of the differences between frequencies col- 
lected in the different bases. Those differences are very 
small parameters when those bases are strongly overlap- 
ping, which corresponds to a high value of the determi- 
nant D of the matrix that maps the average probabil- 
ities of firing that are measured during the experiment 
onto the coefficients of the density matrix. In such a case 
the small experimental discrepancies that affect the mea- 
sured mean frequencies are strongly amplified during the 
estimation process of the density matrix and a precise 
tomography requires, in accordance with the law of large 
numbers, a high number of data. As we see, a "good" 
tomographic process corresponds to a small value of the 
determinant D. 

We could as well have defined the parity of permutations 
following the mathematical tradition in which the par- 
ity of a permutation is defined to be equal to the parity 
of the number of elementary (two by two) permutations 
necessary for realizing this permutation. 
Actually, the 12 remaining (odd) permutations can be 
decomposed into the permutation that fi xes (00 ) b and 



(11)" and permutes (01) b and (lO) 6 (see ( |6|7|8|9| ), and 
an even permutation that can be realised by a unitary 
transformation (either a 180 degrees rotation around one 
of the three main axes X, Y, Z or a 120 degrees rotation 
around one of the four branches of the tetrahedron or the 
identity) . 

In a next section we shall present experimental results 
that were collected in this configuration. As we have 
shown in section [III B| such a configuration is equivalent 
to the TT configuration, up to a well-chosen rotation and 
a well-chosen (odd) permutation of a pair of local detec- 
tors. 

The Pauli group is a subgroup of the Clifford group that 
also counts 24 elements. There is a close connection be- 
tween the qubit Clifford group that consists of 24 unitary 
transformations that map Pauli operators onto them- 
selves under conjugation [35] and the group of permu- 
tations considered in the present paper. 



VII. APPENDIX: WIGNER DISTRIBUTIONS 
OF BELL STATES. 

A. Wigner operators and tetrahedrons. 

Wigner operators or phase space point operators are 
self-adjoint operators that generalise their continuous 
counterpart. They are usually defined in such a way that 
(a) their Trace is equal to 1, (b) they are orthogonal with 
each other and normalised to d (under the Trace norm) 
(c) if we consider any set of parallel lines in the phase 
space, the average of the Wigner operators along one of 
those lines is equal to a projector onto a pure state, and 
the averages taken along different parallel lines are pro- 
jectors onto mutually orthogonal states, (d) the average 
taken along different and non-parallel lines are projectors 
onto mutually unbiased states and (e) they are transla- 
tionally invariant which means that once we know one of 
them we can find the d 2 — 1 remaining Wigner operators 
by letting act the displacement operators onto this one, 
(f ) their sum is equal to d times the identity. 

In a discrete Hilbert space, the phase space is repre- 
sented by a d times d grid and it is not so simple to define 
properly the concept of parallelism. Nevertheless, when 
the dimension is the power of a prime it is possible 

( 1 ) to structure a d times d phase space grid in order to 
find d+1 sets of d parallel straight lines with d points such 
that (parallel) lines from a same set do not intersect, and 
(non-parallel) lines from different sets intersect in only 
one point; 

(2) to find Wigner operators that satisfy the properties 
(a,b,c,d,e,f) enunciated here above. 

The Wigner distribution of a state is a quasi- 
probability of which the d 2 components are equal to the 
trace of the product of its density matrix with the Wigner 
operators divided by d. 

In the qubit case, the Wigner operators are defined 
nearly unambiguously by those properties: as the aver- 
age of the Wigner operators along lines of different sets 
are equal to projectors onto pure states from mutually 
unbiased bases, and that the natural MUBs associated 
to the Pauli group are the X, Y and Z bases, we find 
that each Wigner operator is equal to the sum of projec- 
tors onto states from those three bases minus the identity 
operator divided by 2 (in accordance with e.g. equation 
Q). Therefore, there exist 8 possible ways to define 
a qubit Wigner operator, because in each MUB we are 
free to choose between two basis states. If moreover, we 
associate to the horizontal axis the translation operator 
ax and to the vertical axis the translation operator az, 
this choice determines all the other Wigner operators (in 
virtue of translational invariance) . There are thus 8 ways 
to derive a complete set of qubit Wigner operators. It is 
worth noting that some of them are equivalent up to a 
Pauli symmetry, and there are four such symmetries, so 
that there are two sets of 4 Wigner operators that are, 
inside a given set, unitarily equivalent. We pass from 
one set to the other through an anti-unitary transforma- 
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tion. In analogy with the section 4.1 where this concept 
is introduced, we can associate a parity to the Wigner 
operators, so that 4 of them are even and four of them 
are odd; all Wigner distributions then consist of 4 Wigner 
operators of same parity that are translationally equiva- 
lent. 

In order to build a factorisable two qubits Wigner oper- 
ator we must consider the 64 products of the local A and 
B Wigner operators and check whether they fulfill the 
list of constraints (a) to (f). One can show [221 [SH] that 
only 32 such products provide an acceptable two-qubits 
Wigner distribution, and that they consist of products 
of local qubit operators of different parities (what we de- 
noted the tetrahedron-anti-tetrahedron (T-A) configura- 
tions throughout the paper). 

It is worth noting that, relatively to the T-T configu- 
ration there are few concrete advantages in realising the 
experiment in the T-A configuration from the point of 
view of tomography. The performances of both tomo- 
graphic process are very similar and comparable. 

Formally, the interest of performing the T-A configu- 
ration is that it provides us a quartit Wigner distribution 
(as is shown in Ref. |33J [25] , the quartit Wigner distribu- 
tion does never factorize into a T-T distribution) . 

An advantage of having a quartit Wigner distribu- 
tion at ones disposal is due to the fact that well-chosen 
marginals of this distribution are proportional to the av- 
erage values of one-dimensional projectors onto states 
that belong to MUBs. Those marginals are obtained by 
summing the Wigner coefficients along straight lines with 
four elements that belong to the phase-space with 16 el- 
ements (k,l where k and I run from to 3). Such a 
4 times 4 grid can be structured as an affine plane so 
that it is possible to find 5 sets of four parallel lines with 
four elements such that parallel lines do not intersect and 
non-parallel lines intersect in one point only. To each set 
of four parallel lines (direction) corresponds a MUB of 
which each state corresponds to one line. Three MUBs 
are factorisable into products of local qubit MUBs, while 
two MUBs are not factorisable and consist of maximally 
entangled states [23] . If we want to evaluate the probabil- 
ities of transition of an unknown quantum state to those 
maximally entangled states it is useful to perform the 
tomographic procedure in the T-A configuration because 
the evaluation of the marginals requires to measure only 
four joint probabilities, which is less than the 16 joint 
probabilities that must be measured in order to evalu- 
ate the full density matrix. Otherwise, for instance in 
the context of quantum cryptography it does not really 
matter wheter we choose the T-T or T-A configuration 
because all what matters are the physical correlations, 
which arc independent on the relabelling of the branches 
of the tetrahedron, and we can always pass from one con- 
figuration to the other by relabelling the detectors in an 
ad hoc manner. 



Theoretical determination of the Wigner 
distributions of Bell states. 



It is interesting to evaluate the quartit Wigner distri- 
butions of Bell states and to compare their expressions 
with the generic expressions derived in Ref. |35j . For the 
singlet state for instance we find that 
p=(l/4)(Id. ab - <j x a b x - a^a b Y - a%u\) 



'x u x 

= (l/4)(W 00 TU nn 



xrrtet^aTTT-antitetjb 
VV 10 VV 1Q 



Z U ZJ 
jjT-tet ,a TTT-antitet.b 

w 01 w 01 



TTrtet ,a jTT-antitet ,b\ 
W ll VV U ll 

where the "tet" Wigner operators are defined in accor- 
dance with the equation Q while the (odd) "antitet" op- 
erators are obtained from the corresponding (even) "tet" 
operators by inverting the signs of the ax, oy, and oz 
operators. 

Now, the phase space grid can be built (among others) 
by assigning to the Wigner operator ]Y-j t ' a W^" tltet ' b the 
coordinates (m, n) according to 



m = i a ■ 1 + k b ■ 2, n = j a ■ 1 + l b ■ 2, 
(m,n : 0, l,2,3and i a ,k b ,j a ,l b = 0, 1). 



(16) 



The Wigner distribution over the phase space grid cor- 
responds thus to the matrix 



W 



1/4 1/4 





1/4 1/4 



(17) 



via the relation W m<n — Tr.p.W^ b n . 

There exist several other ways to define Wigner distri- 
butions. For instance we could remain in the T-T config- 
uration where the singlet state is associated to the coef- 
ficients W mn — 1/8 — l/4<5 mj „ derived at the level of the 
equation [12] and keep in mind that we can relabel them 
in order to pass to a T-A configuration by permuting two 
branches (01 and 10) of say the b tetrahedron, permuting 
the roles of X b and Z b , and inverting the signs of those 
axes (due to the rotation of matrix O defined at equation 
[BJ. By doing so, we get another Wigner distribution: 



W' = 



/-1/8 1/8 
1/8 1/8 
1/8 1/8 
V -1/8 1/8 



1/8 -1/8 

1/8 1/8 

1/8 1/8 

1/8 -1/8 



(18) 



It is shown in Ref. |35j with the help of very general 
arguments that the two matrices W and W do cover all 
possible phase space representations of Bell states (up to 
trivial reorderings associated to translations generated by 
the local displacement operators) . The Wigner distribu- 
tions considered in Ref. [35 contain our distributions as 
a special case but, as we see, the reduced set of 32 fac- 
torisable Wigner distributions j23j [29] considered by us 
in this paper captures the essential features of the most 
general case. 



